Privacy Policy

01 Overview & Scope

Starcat is a local-first macOS application. The vast majority of your data never leaves your Mac. This policy applies to the Mac App Store distribution of Starcat.

Starcat is designed to minimize data collection by default. We believe you should control your data, not us.

02 Data We Collect

2.1 Information You Provide

GitHub OAuth: When you sign in with GitHub, Starcat receives an OAuth access token with read:user and public_repo scopes. This token is stored locally in your Mac's Keychain and is used only to authenticate GitHub API requests from the app.

AI and Search Provider Keys: If you configure AI or External Search features, you may provide API keys for your chosen provider (e.g., OpenAI, Gemini, DeepSeek, AnySearch, Tavily, Exa, or Brave Search). These keys are stored locally in your Mac's Keychain and are never transmitted to Starcat servers.

2.2 Information Collected Automatically

GitHub Data: When you use Starcat, the app fetches your starred repositories, their metadata (description, topics, language, stars count), README content, and release information from the GitHub API. This data is cached locally in a SQLite database on your Mac.

Starcat Service APIs: The app may request data from Starcat-operated services for discovery features (trending repos, weekly picks, popular repos) and OpenSSF Scorecard data. These requests do not include your personal data, GitHub identity, or API keys.

App Store Receipt Validation: When verifying your Pro subscription, the app communicates with Apple's App Store servers to validate the receipt. This is handled by Apple's StoreKit framework.

2.3 Optional Anonymous Telemetry

Anonymous telemetry is off by default. If you enable it in Settings → Diagnostics and this build is configured with Aptabase, Starcat sends allowlisted event names, the app version, and coarse value buckets to Aptabase to understand feature reliability and usage. Telemetry excludes your GitHub identity, repository names, search queries, README content, notes, AI prompts or responses, API keys, tokens, and local file paths. It is not used for advertising or cross-app tracking.

03 Data Starcat Services Don't Collect

Except when you explicitly select a Starcat-operated AI proxy, Starcat-operated services do not receive or store:

• Your GitHub Stars list or organization data (tags, notes, status)
• Your GitHub OAuth token (stored in your local Keychain only)
• Your AI or External Search provider API keys (stored in your local Keychain only)
• Your RAG questions, knowledge-base content, private notes, attachments, or conversation history
• Your app usage data unless you explicitly enable anonymous telemetry
• Your README reading history
• Crash reports (unless you choose to share via Apple's crash reporting)

This section describes Starcat-operated services. If you invoke remote AI, Embedding, GitHub live context, or External Search, the provider you selected receives the request data described in Sections 5 and 6.

04 How Your Data Is Stored

4.1 Local Storage

Your data is stored in the following locations on your Mac:

• SQLite Database (GRDB.swift): Repository cache, tags, notes, status, settings, RAG knowledge chunks and vectors, conversations, citations, and AI summary cache are stored in a local SQLite database in the app's Application Support directory.
• Keychain: GitHub OAuth token and AI or External Search provider API keys are stored securely in the macOS Keychain, encrypted with your login credentials.

4.2 No Cloud Sync

The App Store version of Starcat does not sync your data to any cloud service. There is no Starcat account system, no cloud backup, and no server-side storage of your tags, notes, or organization data.

4.3 Data Export & Deletion

You can export your data at any time via the app's JSON/HTML/Markdown export feature. Deleting the Starcat app from your Mac removes all local data. You can also revoke GitHub OAuth access from your GitHub account settings at any time.

05 How We Use Data

5.1 GitHub API

Your GitHub OAuth token is used exclusively to authenticate requests to the GitHub API for syncing your stars, fetching repository metadata, README content, and release information. These requests originate from the app on your Mac and go directly to GitHub's servers.

5.2 AI Features

When you trigger AI features such as summaries, tag suggestions, chat, translation, or knowledge-base RAG, the app sends the content needed for that request to the AI provider you configured. Depending on the feature, this may include your question, a limited window of conversation history, repository metadata, README text, AI summaries, retrieved knowledge chunks (including private notes), attachments you selected for that turn, repository code context, and temporary GitHub or web context.

When you configure a remote Embedding or reranking provider, Starcat sends the knowledge text needed to create vectors or rerank retrieved evidence. If you use a local model such as Ollama, that model's processing remains on your Mac.

BYOK requests go from your Mac to the provider endpoint using your own API key. If a Starcat-operated AI proxy is offered and you explicitly select it, the request passes through that service; request content is not persistently stored, while limited operational metadata such as request time, quota usage, and error codes may be retained for service operation and abuse prevention. RAG conversations and answers you choose to keep are stored locally on your Mac.

5.3 External Search and Live GitHub Context

When you enable External Search for a RAG turn, Starcat sends a generated search query and request settings to the External Search provider you selected. Search results are used as temporary evidence for that turn. Web result content is not written to long-term RAG history; Starcat may keep local audit metadata such as provider name, query summary, result count, URLs, timing, and errors.

Private repository names are excluded from External Search queries unless you enable the separate private-repository search setting. Live GitHub context requests, such as Issues, Pull Requests, or Releases, go directly from your Mac to GitHub and are subject to GitHub's privacy policy.

5.4 Starcat Service APIs

Discovery feeds (trending, weekly, popular) and OpenSSF Scorecard requests go to Starcat-operated services. These requests are anonymous — they include no personal identifiers, GitHub tokens, or user data.

5.5 Support Communication

If you contact us at dong4j@gmail.com, we will use your email address only to respond to your inquiry. We do not use support emails for marketing or any other purpose.

06 Third-Party Services

6.1 GitHub

Starcat uses the GitHub API to sync stars and fetch repository data. Your use of GitHub through Starcat is also governed by GitHub's Privacy Statement.

6.2 AI Providers (BYOK)

Starcat supports multiple AI providers (OpenAI, Anthropic-compatible services, Gemini, DeepSeek, Ollama, and OpenAI-compatible APIs). When you configure a remote provider with your own API key, requests are sent from your Mac to that provider. Each provider controls its own retention and processing practices — please review the policy and account settings of the provider you choose.

6.3 External Search Providers

Optional External Search may use AnySearch, Tavily, Exa, or Brave Search. The selected provider receives the search query and request options needed to return results.

6.4 Aptabase (Optional Analytics)

If you explicitly enable anonymous telemetry, Aptabase receives the limited product events described in Section 2.3. Telemetry is disabled by default and is not linked to your GitHub identity or used for tracking. See Aptabase's Privacy Policy.

6.5 Apple

Pro subscriptions are managed by Apple through In-App Purchase. Apple processes your payment information and manages your subscription. We do not receive or store your payment details. See Apple's Privacy Policy.

07 Pro Subscription

7.1 Managed by Apple

The Pro subscription is an Apple In-App Purchase. Payment processing, subscription management, renewal, and cancellation are all handled by Apple through your Apple ID. Starcat does not collect or store your payment information.

7.2 Receipt Validation

The app uses Apple's StoreKit framework to validate your subscription status locally on your Mac. Receipt validation communicates with Apple's servers to verify the authenticity and status of your subscription. No personal data is sent to Starcat servers during this process.

7.3 No External Payment

The App Store version of Starcat does not use or support any external payment methods, third-party payment processors, or license key activation systems. All Pro features are unlocked exclusively through Apple In-App Purchase.

08 Your Rights & Choices

8.1 Data Access & Portability

You can export your data at any time via the app's built-in export feature (JSON, HTML, or Markdown format). Since your data is stored locally, you have full access to it at all times.

8.2 Data Deletion

You can delete your data by removing the Starcat app from your Mac. You can also revoke GitHub OAuth access from your GitHub Authorized Applications settings at any time.

8.3 Subscription Cancellation

You can cancel your Pro subscription at any time through your Apple ID account settings (App Store → Account → Subscriptions). Upon cancellation, you will retain Pro access until the end of the current billing period.

8.4 Contact for Privacy Requests

For any privacy-related questions or requests, contact us at dong4j@gmail.com.

09 Children's Privacy

Starcat is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the app, please contact us.

10 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Starcat after changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

11 Contact Us

If you have questions about this Privacy Policy or Starcat's privacy practices, please contact us:

• Email: dong4j@gmail.com
• Support: Starcat Support Page

We aim to respond to all privacy-related inquiries within 7 business days.